Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the github-actions group across 1 directory with 13 updates #296

Closed
wants to merge 1 commit into from
Closed

Bump the github-actions group across 1 directory with 13 updates #296

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 13, 2024 •
edited
Loading

Bumps the github-actions group with 13 updates in the / directory:

Package From To
step-security/harden-runner 2.5.1 2.7.1
actions/checkout 3.5.3 4.1.5
EmbarkStudios/cargo-deny-action 1.5.5 1.6.3
docker/login-action 3.0.0 3.1.0
docker/metadata-action 5.0.0 5.5.1
docker/build-push-action 5.0.0 5.3.0
peter-evans/dockerhub-description 3.4.2 4.0.0
fsfe/reuse-action 2 3
github/codeql-action 2.22.5 3.25.5
ossf/scorecard-action 2.3.1 2.3.3
actions/upload-artifact 3.1.2 4.3.3
crate-ci/typos 1.16.21 1.21.0
codecov/codecov-action 3 4

Updates step-security/harden-runner from 2.5.1 to 2.7.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.7.1

What's Changed

Release v2.7.1 by @​varunsh-coder, @​h0x0er, @​ashishkurmi in step-security/harden-runner#397 This release:

  • Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
  • Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
  • Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

v2.7.0

What's Changed

Release 2.7.0 by @​varunsh-coder and @​h0x0er in step-security/harden-runner#376 This release:

  1. Updates the node runtime to node20
  2. Adds capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Full Changelog: step-security/harden-runner@v2...v2.7.0

v2.6.1

What's Changed

Release v2.6.1 by @​varunsh-coder and @​h0x0er in step-security/harden-runner#356 This release:

  1. Improves the job summary markdown written by the Harden-Runner Action
  2. Improves detection of cache endpoint used by the job
  3. Detects use of Kubernetes mode in Actions Runner Controller (ARC) based runners
  4. Updates dependencies

Full Changelog: step-security/harden-runner@v2...v2.6.1

v2.6.0

What's Changed

Release v2.6.0 by @​varunsh-coder in step-security/harden-runner#346

This release adds support for self-hosted Virtual Machine runners (e.g. on EC2).

Full Changelog: step-security/harden-runner@v2...v2.6.0

Commits

Updates actions/checkout from 3.5.3 to 4.1.5

Release notes

Sourced from actions/checkout's releases.

v4.1.5

What's Changed

Full Changelog: actions/checkout@v4.1.4...v4.1.5

v4.1.4

What's Changed

Full Changelog: actions/checkout@v4.1.3...v4.1.4

v4.1.3

What's Changed

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

We are investigating the following issue with this release and have rolled-back the v4 tag to point to v4.1.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.1.1...v4.1.2

v4.1.1

What's Changed

New Contributors

... (truncated)

Commits

Updates EmbarkStudios/cargo-deny-action from 1.5.5 to 1.6.3

Release notes

Sourced from EmbarkStudios/cargo-deny-action's releases.

v1.6.1

Fixed

  • PR#626 resolved #625 by explicitly checking that a license identified as Pixar was actually (probably) the Pixar license, instead of a normal Apache-2.0 license.

v1.6.0

action changes

  • Color output is now always enabled so that colors show up in the action output.

0.14.15

Added

  • PR#618 added metadata notes to diagnostics when a license is rejected, as well as removing span information for accepted licenses unless the log level is info or higher to make the diagnostic clearer by default.

0.14.14

Fixed

  • PR#617 resolved #576 by updating the SPDX license list to 3.23.

0.14.13

Fixed

  • PR#615 fixed an issue introduced in PR#605 where the various bans diagnostic codes could not have their lint level changed via the CLI. It also introduced the deprecated diagnostic code.

0.14.12

Changed

  • PR#605 did a major refactor of configuration, both how it is deserialized and changing (hopefully improving) many options.
  • PR#605 moved targets, exclude, all-features, features, no-default-features, and exclude into the [graph] table.
  • PR#605 moved feature-depth into the [output] table.

Added

  • PR#613 added support for basic shell expansion to advisories.db-path, which expands support beyond just ~ to include environment variable expansion.

Fixed

  • PR#601 resolved #600 by outputting the correct spans when a license was both allowed and denied.
  • PR#605 resolved #264 be replacing toml and serde with toml-span.
  • PR#605 resolved #539 by simplifying the very common name = "<crate_name>", version = "<requirements>" used to target specific crates into either a plain package spec string or the simpler crate = "<package spec>".
  • PR#605 resolved #578 by adding a reason = "<reason>" field to many fields within the configuration that are provided in diagnostics. [bans.deny] also has an additional use-instead = "<url/crate_name>". PR#610 did this for the advisories.ignore field.
  • PR#605 resolved #579 by allowing yanked crates to be ignored by specifying a PackageSpec in the [advisories.ignore] array.

Deprecated

  • PR#606 and PR#611 together deprecated several fields listed below. See PR#611 for how to change your config to opt-in to the new behavior that will become the default when the deprecated fields are removed in a future minor version.
    • [advisories]
      • vulnerability
      • unmaintained
      • unsound
      • notice
      • severity-threshold
    • [licenses]
      • unlicensed
      • allow-osi-fsf-free
      • copyleft
      • default
      • deny
Commits

Updates docker/login-action from 3.0.0 to 3.1.0

Release notes

Sourced from docker/login-action's releases.

v3.1.0

Full Changelog: docker/login-action@v3.0.0...v3.1.0

Commits
  • e92390c Merge pull request #685 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • 1e752e2 chore: update generated content
  • 51c6097 build(deps): bump the aws-sdk-dependencies group with 2 updates
  • 8f079fb Merge pull request #676 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
  • 16fa768 chore: update generated content
  • 46d1619 build(deps): bump the proxy-agent-dependencies group with 2 updates
  • 8c291c5 Merge pull request #682 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • ec726f4 build(deps): bump @​docker/actions-toolkit from 0.14.0 to 0.18.0
  • 5139682 Merge pull request #677 from docker/dependabot/npm_and_yarn/undici-5.28.3
  • 6d4e2ba chore: update generated content
  • Additional commits viewable in compare view

Updates docker/metadata-action from 5.0.0 to 5.5.1

Release notes

Sourced from docker/metadata-action's releases.

v5.5.1

Full Changelog: docker/metadata-action@v5.5.0...v5.5.1

v5.5.0

Full Changelog: docker/metadata-action@v5.4.0...v5.5.0

v5.4.0

Full Changelog: docker/metadata-action@v5.3.0...v5.4.0

v5.3.0

Full Changelog: docker/metadata-action@v5.2.0...v5.3.0

v5.2.0

Full Changelog: docker/metadata-action@v5.1.0...v5.2.0

v5.1.0

Full Changelog: docker/metadata-action@v5.0.0...v5.1.0

Commits
  • 8e5442c Merge pull request #382 from crazy-max/dont-set-cwd-prefix
  • eda41b7 chore: update generated content
  • 388c08f don't set cwd:// prefix for local bake files
  • dbef880 Merge pull request #374 from docker/dependabot/npm_and_yarn/moment-timezone-0...
  • b73e7a7 chore: update generated content
  • b9fba69 chore(deps): Bump moment-timezone from 0.5.43 to 0.5.44
  • ac82374 Merge pull request #373 from docker/dependabot/npm_and_yarn/moment-2.30.1
  • c92519a chore: update generated content
  • 3b4179d chore(deps): Bump moment from 2.29.4 to 2.30.1
  • 0784993 Merge pull request #371 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • Additional commits viewable in compare view

Updates docker/build-push-action from 5.0.0 to 5.3.0

Release notes

Sourced from docker/build-push-action's releases.

v5.3.0

Full Changelog: docker/build-push-action@v5.2.0...v5.3.0

v5.2.0

Full Changelog: docker/build-push-action@v5.1.0...v5.2.0

v5.1.0

Full Changelog: docker/build-push-action@v5.0.0...v5.1.0

Commits
  • 2cdde99 Merge pull request #1080 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • 008747a chore: update generated content
  • 1580753 chore(deps): Bump @​docker/actions-toolkit from 0.18.0 to 0.19.0
  • 2a7db1d Merge pull request #1075 from crazy-max/ci-multi-output
  • 35e7dd5 ci: test multi output
  • af5a7ed Merge pull request #1074 from crazy-max/build-cmd-debug
  • 2a85189 chore: update generated content
  • 6c20794 disable quotes detection for "outputs" input
  • afdf0c0 chore: debug build cmd and args
  • 00ae31a Merge pull request #1070 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • Additional commits viewable in compare view

Updates peter-evans/dockerhub-description from 3.4.2 to 4.0.0

Release notes

Sourced from peter-evans/dockerhub-description's releases.

Docker Hub Description v4.0.0

⚙️ Updated runtime to Node.js 20

  • The action now requires a minimum version of v2.308.0 for the Actions runner. Update self-hosted runners to v2.308.0 or later to ensure compatibility.

What's Changed

... (truncated)

Commits
  • e98e4d1 feat: update runtime to node 20 (#246)
  • 487b453 build(deps-dev): bump @​types/node from 16.18.70 to 16.18.73 (#245)
  • f4367f9 build(deps-dev): bump prettier from 3.2.2 to 3.2.4 (#244)
  • 48ae68f build(deps-dev): bump @​types/node from 16.18.69 to 16.18.70 (#241)
  • dfc61b8 build(deps-dev): bump prettier from 3.1.1 to 3.2.2 (#243)
  • 74967fb build(deps-dev): bump eslint-plugin-prettier from 5.1.2 to 5.1.3 (#242)
  • 7ea9d27 build(deps-dev): bump @​types/node from 16.18.68 to 16.18.69 (#240)
  • 7bc76ab build(deps-dev): bump eslint-plugin-prettier from 5.0.1 to 5.1.2 (#239)
  • 5a219e7 build(deps): bump actions/download-artifact from 3 to 4 (#236)
  • fb37f44 build(deps-dev): bump eslint from 8.55.0 to 8.56.0 (#238)
  • Additional commits viewable in compare view

Updates fsfe/reuse-action from 2 to 3

Release notes

Sourced from fsfe/reuse-action's releases.

v3.0.0

What's Changed

New Contributors

Full Changelog: fsfe/reuse-action@v2.0.0...v3.0.0

Commits
  • a46482c Merge pull request #28 from fsfe/reuse-v3
  • cd6bf02 test all major versions in workflow
  • 577d39f bump to reuse-tool major version 3
  • 4a900d3 Merge pull request #25 from ChristianTackeGSI/main
  • 1e652d5 chore: upgrade checkout step to v4
  • 9522816 rename master -> main
  • c1c6c29 Merge pull request #23 from fsfe/ci-expand-tests
  • 7247931 improve and extend CI pipeline
  • See full diff in compare view

Updates github/codeql-action from 2.22.5 to 3.25.5

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.5 - 13 May 2024

  • Add a compatibility matrix of supported CodeQL Action, CodeQL CLI, and GitHub Enterprise Server versions to the https://github.com/github/codeql-action/blob/main/README.md. #2273
  • Avoid printing out a warning for a missing on.push trigger when the CodeQL Action is triggered via a workflow_call event. #2274
  • The tools: latest input to the init Action has been renamed to tools: linked. This option specifies that the Action should use the tools shipped at the same time as the Action. The old name will continue to work for backwards compatibility, but we recommend that new workflows use the new name. #2281

3.25.4 - 08 May 2024

  • Update default CodeQL bundle version to 2.17.2. #2270

3.25.3 - 25 Apr 2024

  • Update default CodeQL bundle version to 2.17.1. #2247
  • Workflows running on macos-latest using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as macos-12. ARM machines with SIP disabled, including the newest macos-latest image, are unsupported for CLI versions before 2.15.1. #2261

3.25.2 - 22 Apr 2024

No user facing changes.

3.25.1 - 17 Apr 2024

  • We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuild build mode. #2235
  • Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245

3.25.0 - 15 Apr 2024

  • The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224

    As a result, the following inputs and environment variables are now ignored:

    • The setup-python-dependencies input to the init Action
    • The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable

    We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.

  • Automatically overwrite an existing database if found on the filesystem. #2229

  • Bump the minimum CodeQL bundle version to 2.12.6. #2232

  • A more relevant log message and a diagnostic are now emitted when the file program is not installed on a Linux runner, but is required for Go tracing to succeed. #2234

3.24.10 - 05 Apr 2024

... (truncated)

Commits
  • b7cec75 Merge pull request #2287 from github/update-...

    Description has been truncated

@dependabot
Bump the github-actions group across 1 directory with 13 updates
6d32bf8 
Bumps the github-actions group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.5.1` | `2.7.1` |
| [actions/checkout](https://github.com/actions/checkout) | `3.5.3` | `4.1.5` |
| [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) | `1.5.5` | `1.6.3` |
| [docker/login-action](https://github.com/docker/login-action) | `3.0.0` | `3.1.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.0.0` | `5.5.1` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `5.0.0` | `5.3.0` |
| [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) | `3.4.2` | `4.0.0` |
| [fsfe/reuse-action](https://github.com/fsfe/reuse-action) | `2` | `3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `2.22.5` | `3.25.5` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.1` | `2.3.3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `3.1.2` | `4.3.3` |
| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.16.21` | `1.21.0` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `3` | `4` |



Updates `step-security/harden-runner` from 2.5.1 to 2.7.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@v2.5.1...a4aa98b)

Updates `actions/checkout` from 3.5.3 to 4.1.5
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v3.5.3...v4.1.5)

Updates `EmbarkStudios/cargo-deny-action` from 1.5.5 to 1.6.3
- [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases)
- [Commits](EmbarkStudios/cargo-deny-action@1e59595...3f4a782)

Updates `docker/login-action` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@343f7c4...e92390c)

Updates `docker/metadata-action` from 5.0.0 to 5.5.1
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@96383f4...8e5442c)

Updates `docker/build-push-action` from 5.0.0 to 5.3.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@0565240...2cdde99)

Updates `peter-evans/dockerhub-description` from 3.4.2 to 4.0.0
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](peter-evans/dockerhub-description@dc67fad...e98e4d1)

Updates `fsfe/reuse-action` from 2 to 3
- [Release notes](https://github.com/fsfe/reuse-action/releases)
- [Commits](fsfe/reuse-action@v2...v3)

Updates `github/codeql-action` from 2.22.5 to 3.25.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@74483a3...b7cec75)

Updates `ossf/scorecard-action` from 2.3.1 to 2.3.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@0864cf1...dc50aa9)

Updates `actions/upload-artifact` from 3.1.2 to 4.3.3
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v3.1.2...6546280)

Updates `crate-ci/typos` from 1.16.21 to 1.21.0
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@47dd297...d503507)

Updates `codecov/codecov-action` from 3 to 4
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v3...v4)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: EmbarkStudios/cargo-deny-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: peter-evans/dockerhub-description
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: fsfe/reuse-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: crate-ci/typos
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 13, 2024
@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github May 20, 2024

Superseded by #297.

@dependabot dependabot bot closed this May 20, 2024
@dependabot dependabot bot deleted the dependabot/github_actions/github-actions-bd57305809 branch May 20, 2024 17:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants